Which of the following should be the PRIMARY basis for the development of a business case to obtain support for an information security project?

The correct answer is D. Risk tolerance levels. The primary basis for developing a business case for an information security project is the organization’s risk tolerance levels. This defines how much risk the organization is willing to accept and guides decisions on what level of security investment is necessary. Aligning…

Submitted by marco_it· Apr 18, 2026Information Security Risk Management

Question

Options

ABudgetary requirements
BFeasibility study
CEnterprise architecture (EA)
DRisk tolerance levels

How the community answered

(41 responses)

A
2% (1)
B
7% (3)
C
12% (5)
D
78% (32)

Explanation

The primary basis for developing a business case for an information security project is the organization’s risk tolerance levels. This defines how much risk the organization is willing to accept and guides decisions on what level of security investment is necessary. Aligning the project with the organization’s risk appetite ensures that the initiative directly supports business objectives and justifies the need for resources and funding.

Topics

#Business Case Development#Information Security Project Justification#Risk Tolerance#Risk Management

Community Discussion

No community discussion yet for this question.

Full CISM Practice